From 20873db5964550314f26d77bddfe9c995dd9e6c8 Mon Sep 17 00:00:00 2001 From: Damian Szuberski Date: Wed, 20 Mar 2024 04:38:27 +1000 Subject: [PATCH] use less-than instead of not-equal when comparing key sizes (#242) When evaluating policy compliance, use less-than operator so keys bigger than expected (and hence very often better) don't fail policy evaulation. This change reduces the amount of false-positives and allows for more flexibility when hardening SSH installations. Signed-off-by: szubersk --- src/ssh_audit/policy.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/ssh_audit/policy.py b/src/ssh_audit/policy.py index 9918147..ef3b155 100644 --- a/src/ssh_audit/policy.py +++ b/src/ssh_audit/policy.py @@ -367,11 +367,11 @@ macs = %s hostkey_types = list(self._hostkey_sizes.keys()) hostkey_types.sort() # Sorted to make testing output repeatable. for hostkey_type in hostkey_types: - expected_hostkey_size = self._hostkey_sizes[hostkey_type]['hostkey_size'] + expected_hostkey_size = cast(int, self._hostkey_sizes[hostkey_type]['hostkey_size']) server_host_keys = kex.host_keys() if hostkey_type in server_host_keys: - actual_hostkey_size = server_host_keys[hostkey_type]['hostkey_size'] - if actual_hostkey_size != expected_hostkey_size: + actual_hostkey_size = cast(int, server_host_keys[hostkey_type]['hostkey_size']) + if actual_hostkey_size < expected_hostkey_size: ret = False self._append_error('Host key (%s) sizes' % hostkey_type, [str(expected_hostkey_size)], None, [str(actual_hostkey_size)]) @@ -387,7 +387,7 @@ macs = %s ret = False self._append_error('CA signature type', [expected_ca_key_type], None, [actual_ca_key_type]) # Ensure that the actual and expected signature sizes match. - elif actual_ca_key_size != expected_ca_key_size: + elif actual_ca_key_size < expected_ca_key_size: ret = False self._append_error('CA signature size (%s)' % actual_ca_key_type, [str(expected_ca_key_size)], None, [str(actual_ca_key_size)]) @@ -446,7 +446,7 @@ macs = %s expected_dh_modulus_size = self._dh_modulus_sizes[dh_modulus_type] if dh_modulus_type in kex.dh_modulus_sizes(): actual_dh_modulus_size = kex.dh_modulus_sizes()[dh_modulus_type] - if expected_dh_modulus_size != actual_dh_modulus_size: + if expected_dh_modulus_size > actual_dh_modulus_size: ret = False self._append_error('Group exchange (%s) modulus sizes' % dh_modulus_type, [str(expected_dh_modulus_size)], None, [str(actual_dh_modulus_size)])